CBSA Security & Compliance 5 — Questions and Answers
Question 1: In a multi-organizational blockchain consortium, which governance mechanism helps enforce compliance across participants with different regulatory jurisdictions?
- A single global smart contract that overrides local regulations
- Consortium governance framework with jurisdiction-specific policy layers (Correct answer)
- Delegating all compliance decisions to the founding organization
- Using Proof of Authority with regulators as the sole validators
Correct answer: Consortium governance framework with jurisdiction-specific policy layers
A consortium governance framework with jurisdiction-specific policy layers allows each organization to meet its local regulatory requirements while participating in the shared blockchain network.
Question 2: What is the function of a 'multi-party computation (MPC)' protocol in blockchain key management?
- Distributing transaction validation across multiple consensus nodes
- Enabling multiple parties to jointly compute operations on private keys without any single party seeing the full key (Correct answer)
- Splitting the blockchain ledger across multiple databases
- Coordinating simultaneous smart contract execution across chains
Correct answer: Enabling multiple parties to jointly compute operations on private keys without any single party seeing the full key
MPC allows multiple parties to collaboratively perform cryptographic operations such as signing without any single party ever reconstructing or holding the complete private key.
Question 3: Which regulatory requirement mandates that financial institutions maintain an audit trail of all transactions, making blockchain's immutability a natural fit?
- GDPR Article 17
- SOX Section 404 (Correct answer)
- HIPAA Privacy Rule
- CCPA Right to Delete
Correct answer: SOX Section 404
SOX Section 404 requires financial institutions to maintain accurate records and internal controls, and blockchain's immutable audit trail directly supports this requirement.
Question 4: In Hyperledger Fabric, what is the purpose of the 'MSP' (Membership Service Provider)?
- To manage the throughput and scalability of chaincode execution
- To define the rules for validating identities and determining membership in the network (Correct answer)
- To provide a marketplace for smart contract templates
- To coordinate multi-channel transaction ordering
Correct answer: To define the rules for validating identities and determining membership in the network
The MSP in Hyperledger Fabric defines the rules for identity validation and network membership, mapping cryptographic identities to organizational roles and permissions.
Question 5: What distinguishes a 'supply chain attack' on blockchain infrastructure from a traditional cyberattack?
- It targets the consensus algorithm rather than network nodes
- It compromises software or hardware components before they reach the target organization (Correct answer)
- It exploits vulnerabilities in the physical supply chain ledger data
- It uses blockchain transactions to deliver malware payloads
Correct answer: It compromises software or hardware components before they reach the target organization
Supply chain attacks compromise trusted software, libraries, or hardware during development or distribution, so the malicious code arrives pre-installed and trusted by the target.
Question 6: Which cryptographic primitive ensures that a sender cannot later deny having sent a blockchain transaction?
- Symmetric encryption
- Digital signatures (Correct answer)
- Hash functions
- Message authentication codes (MACs)
Correct answer: Digital signatures
Digital signatures provide non-repudiation because only the holder of the private key can produce a valid signature, making it cryptographically verifiable that the key owner authorized the transaction.
Question 7: When conducting a threat model for a public blockchain application, which framework is commonly used to categorize potential threats?
- OWASP Top 10
- STRIDE (Correct answer)
- CVSS
- MITRE ATT&CK
Correct answer: STRIDE
STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is a threat modeling framework widely used to systematically identify and categorize security threats.
CBSA Security & Compliance 5
In a multi-organizational blockchain consortium, which governance mechanism helps enforce compliance across participants with different regulatory jurisdictions?